4 ms·

Linux Foundation rounds up vendor posse to save OpenSSL

22 points by chris-at 13y ago

valarauca1 13y ago
Based on the figures an OpenSSL developer tweeted, their old funding was approximately ~$2,000 per year. (I can't find the source at this exact minute). Hopefully this means OpenSSL will finally be able to afford a few security audits, refactoring, and everything people have wanted.
- midas007 13y ago
  Throwing money at a problem without competent leadership just makes matters works. The leadership has to have a grasp of what's wrong for any of that money to be used effectively. If history were any measure, it seems as likely as a blizzard in the Sahara.
  - richardwhiuk 13y ago
    This outright hatred towards the developers of OpenSSL seems bizarre and unwarranted. Should the heartbleed bug have been caught in code review? Yes. Does the quality of the OpenSSL library leave something to be desired? Yes. Are there likely to be similar bugs in other SSL implementations? Yes. Is LibreSSL / OpenSSL Rampage / PolarSSL / GnuTLS a good alternative? Probably not, due to poor cross platform support, insufficient features, and way fewer eyeballs. Do other crypto libraries have test suites which would have caught this? No, not as far as I can tell - Apple's Security framework bug and the GnuTLS bug should be evidence enough of that. If you want to migrate, go ahead. The best option is probably NSS.
    - mitchty 13y ago
      I'd argue LibreSSL is already doing a better job because they are doing things that should have happened ages ago. Files from 1998 that were supposed to be removed when 1.0 was released? Should've been gone years ago. Code interspersed with platform specific hacks say for VMS(!?!?!? why is this even supported still) that needs to go. Having a simple core that has platform shims on top is a good thing. Ripping out the openssl NIH memcpy/etc... is a good thing. Sometimes the only way forward is to step back and take a better path. Everyone here is annoyed that we likely are throwing good money after bad. If the openssl developers don't practice good software engineering as it is, money won't change that. This is the fundamental worry. I'm skeptical this will result in anything useful. If the years upon years of technical debt in this project aren't cleaned up like libressl has done, I don't see much chance of things improving substantially.
      - midas007 13y ago
        Yes, this is the core worry. OpenSSL needs a press release to commit to a 360-review, top-to-bottom and engage more to lead the tech / stds WG to reduce complexity.
    - midas007 13y ago
      Not switching, not angry... just hold them accountable to simplify their code base AND get the TLS WG to cut back on features. Heartbleed AND LibreSSL will force their hand to make changes.
- joshstrange 13y ago
  >> OSF typically receives about US$2000 a year in outright donations and sells commercial software support contracts[2] and does both hourly rate and fixed price “work-for-hire” consulting as shown on the OSF web site [0] [0] http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ http://veridicalsystems.com/blog/of-money-responsibility-and... ALSO >> In a typical year the OpenSSL project receives about US$2000 in donations. [1] https://groups.google.com/d/msg/mailing.openssl.users/-P4T62ml_1I/cOgioSoOUPEJ https://groups.google.com/d/msg/mailing.openssl.users/-P4T62... Might have been in tweet as well but these were the only sources I could dig up ATM. Both were written by Steve Marquess.
  - midas007 13y ago
    Yeap, aware. But handing someone a multi-million lottery ticket can Anna Nicole Smith them. To start, 50k or so and see how they use it. More as they show ability to budget and results.
    - joshstrange 13y ago
      I don't disagree, I was simply providing sources for midas007's comment. I don't have an opinion (that's worth mentioning) on giving the OpenSSL people money.
      - midas007 13y ago
        It's cool. I think it's a good idea for them to get more than $4k AND code help from industry.
Karunamon 13y ago
Interesting. What makes this effort different from what OpenBSD is doing? I assume rather than the "nuke-from-orbit-and-start-fresh" approach, this will attempt to clean it up and keep platform interoperability and such still around?
- km3k 13y ago
  I assume it will be more of a "clean it up" rather than "nuke it" approach, plus there's a lot more money involved.
  - midas007 13y ago
    Starting over on OpenSSL would cost about 20 mega USD, so that's unlikely. Currently, Ohloh esimates $6.7 mega USD in code cost, but figure 3x for a crypto lib due to inherent challenges of correctness. [0] [0] https://www.ohloh.net/p/openssl/estimated_cost https://www.ohloh.net/p/openssl/estimated_cost
    - Karunamon 13y ago
      When I said "nuke it", I was more referring to the current practice of slashing and burning build support and modifications necessary to allow the library to build on anything but the most popular handful of platforms. The glee with which this is being done (looking at the commits) is palpable.
      - midas007 13y ago
        Ahhh. Yup, I just lightly-forked LibreSSL to bring back some build infrastructure to non-OpenBSD platforms. It's easy for folks to get get carried away, and there will probably be some quiet backpedaling. https://github.com/steakknife/libressl https://github.com/steakknife/libressl
deleted 13y ago
[deleted]
dang 13y ago
This is a dupe of https://news.ycombinator.com/item?id=7639835 https://news.ycombinator.com/item?id=7639835.

22 points by chris-at 13y ago

Based on the figures an OpenSSL developer tweeted, their old funding was approximately ~$2,000 per year. (I can't find the source at this exact minute). Hopefully this means OpenSSL will finally be able to afford a few security audits, refactoring, and everything people have wanted.

midas007 13y ago
Throwing money at a problem without competent leadership just makes matters works. The leadership has to have a grasp of what's wrong for any of that money to be used effectively. If history were any measure, it seems as likely as a blizzard in the Sahara.
- richardwhiuk 13y ago
  This outright hatred towards the developers of OpenSSL seems bizarre and unwarranted. Should the heartbleed bug have been caught in code review? Yes. Does the quality of the OpenSSL library leave something to be desired? Yes. Are there likely to be similar bugs in other SSL implementations? Yes. Is LibreSSL / OpenSSL Rampage / PolarSSL / GnuTLS a good alternative? Probably not, due to poor cross platform support, insufficient features, and way fewer eyeballs. Do other crypto libraries have test suites which would have caught this? No, not as far as I can tell - Apple's Security framework bug and the GnuTLS bug should be evidence enough of that. If you want to migrate, go ahead. The best option is probably NSS.
  - mitchty 13y ago
    I'd argue LibreSSL is already doing a better job because they are doing things that should have happened ages ago. Files from 1998 that were supposed to be removed when 1.0 was released? Should've been gone years ago. Code interspersed with platform specific hacks say for VMS(!?!?!? why is this even supported still) that needs to go. Having a simple core that has platform shims on top is a good thing. Ripping out the openssl NIH memcpy/etc... is a good thing. Sometimes the only way forward is to step back and take a better path. Everyone here is annoyed that we likely are throwing good money after bad. If the openssl developers don't practice good software engineering as it is, money won't change that. This is the fundamental worry. I'm skeptical this will result in anything useful. If the years upon years of technical debt in this project aren't cleaned up like libressl has done, I don't see much chance of things improving substantially.
    - midas007 13y ago
      Yes, this is the core worry. OpenSSL needs a press release to commit to a 360-review, top-to-bottom and engage more to lead the tech / stds WG to reduce complexity.
  - midas007 13y ago
    Not switching, not angry... just hold them accountable to simplify their code base AND get the TLS WG to cut back on features. Heartbleed AND LibreSSL will force their hand to make changes.
joshstrange 13y ago
>> OSF typically receives about US$2000 a year in outright donations and sells commercial software support contracts[2] and does both hourly rate and fixed price “work-for-hire” consulting as shown on the OSF web site [0] [0] http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ http://veridicalsystems.com/blog/of-money-responsibility-and... ALSO >> In a typical year the OpenSSL project receives about US$2000 in donations. [1] https://groups.google.com/d/msg/mailing.openssl.users/-P4T62ml_1I/cOgioSoOUPEJ https://groups.google.com/d/msg/mailing.openssl.users/-P4T62... Might have been in tweet as well but these were the only sources I could dig up ATM. Both were written by Steve Marquess.
- midas007 13y ago
  Yeap, aware. But handing someone a multi-million lottery ticket can Anna Nicole Smith them. To start, 50k or so and see how they use it. More as they show ability to budget and results.
  - joshstrange 13y ago
    I don't disagree, I was simply providing sources for midas007's comment. I don't have an opinion (that's worth mentioning) on giving the OpenSSL people money.
    - midas007 13y ago
      It's cool. I think it's a good idea for them to get more than $4k AND code help from industry.

Karunamon 13y ago

Interesting. What makes this effort different from what OpenBSD is doing? I assume rather than the "nuke-from-orbit-and-start-fresh" approach, this will attempt to clean it up and keep platform interoperability and such still around?

km3k 13y ago
I assume it will be more of a "clean it up" rather than "nuke it" approach, plus there's a lot more money involved.
- midas007 13y ago
  Starting over on OpenSSL would cost about 20 mega USD, so that's unlikely. Currently, Ohloh esimates $6.7 mega USD in code cost, but figure 3x for a crypto lib due to inherent challenges of correctness. [0] [0] https://www.ohloh.net/p/openssl/estimated_cost https://www.ohloh.net/p/openssl/estimated_cost
  - Karunamon 13y ago
    When I said "nuke it", I was more referring to the current practice of slashing and burning build support and modifications necessary to allow the library to build on anything but the most popular handful of platforms. The glee with which this is being done (looking at the commits) is palpable.
    - midas007 13y ago
      Ahhh. Yup, I just lightly-forked LibreSSL to bring back some build infrastructure to non-OpenBSD platforms. It's easy for folks to get get carried away, and there will probably be some quiet backpedaling. https://github.com/steakknife/libressl https://github.com/steakknife/libressl

deleted 13y ago

[deleted]

dang 13y ago

This is a dupe of https://news.ycombinator.com/item?id=7639835 https://news.ycombinator.com/item?id=7639835.